topic Re: Windows Defender problem reported by MICROSOFT in Endpoint Security (ENS)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637515#M5622
<P>Also, please un-mark this as "Solved..."</P>Wed, 09 Oct 2019 21:03:55 GMTbillmoller2019-10-09T21:03:55ZWindows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631504#M4783
<P>Widows 10 fails to detect McAfee ENS 10.6.1 running and windows defender kicks in. This is affecting us due to the fact that our VPN client does a host check and will only allow systems through if McAfee is running and definitions are up to date.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-07-25 065202.png" style="width: 548px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4287i8F935D3923BBD806/image-dimensions/548x350?v=1.0" width="548" height="350" title="Annotation 2019-07-25 065202.png" alt="Annotation 2019-07-25 065202.png" /></span></P><P>&nbsp;</P><P>If we click "Turn On", that is all it takes to fix the issue and VPN connection works normally, but after a couple restarts, the system will revert to this state again forcing the user to manually hit "Turn ON".</P><P>All ENS modules look "enabled" in the console and there arent any other indications of an issue other than Windows Defender being turned ON and the "security providers" showing that shown in the screenshot.</P><P>Windows Version 10.0.17763 Build 17763<BR />OS Name Microsoft Windows 10 Pro</P><P>ENS 10.6.1 July Update (but also observed in vanilla 10.6.1)<BR />Platform: 10.6.1.1555<BR />Threat prevention: 10.6.1.1638</P><P>This wasn't happening before and wondering if other people are seeing the same and if there is a solution.</P>Thu, 25 Jul 2019 15:02:06 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631504#M4783kylekat2019-07-25T15:02:06ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631510#M4784
<P>Could you confirm the exact OS and ENS version installed?</P>Thu, 25 Jul 2019 14:12:45 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631510#M4784chealey2019-07-25T14:12:45ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631516#M4785
<P>Thank you <LI-USER uid="206182"></LI-USER>&nbsp;</P><P>&nbsp;</P><P>Windows Version 10.0.17763 Build 17763<BR />OS Name Microsoft Windows 10 Pro</P><P>ENS 10.6.1 July Update (but also observed in vanilla 10.6.1)<BR />Platform: 10.6.1.1555<BR />Threat prevention: 10.6.1.1638</P>Thu, 25 Jul 2019 14:22:39 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631516#M4785kylekat2019-07-25T14:22:39ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631523#M4786
<P>Great thanks!</P>
<P><A href="https://kc.mcafee.com/corporate/index?page=content&amp;id=KB91428" target="_blank">https://kc.mcafee.com/corporate/index?page=content&amp;id=KB91428</A>&nbsp;&gt;&gt; we did fix this in the May Update so you should definitely not be seeing it with the July Update.</P>
<P>&nbsp;</P>
<P>To help us expedite and troubleshoot this, kindly raise a service request with support. If possible provide the following data to get it reviewed as quickly as possible:</P>
<P>Set debug logging for all ENS modules. <BR />Set amtrace and procmon to log at boot. See KB86691 for parameters.<BR />Restart the system.<BR />Open WSC and check status. Stop amtrace and procmon.<BR />Collect MER, amtrace, and procmon log.</P>
<P>Get the output of the command below; run with Admin CMD prompt:<BR />powershell Get-WmiObject -Namespace "root\SecurityCenter2" -Class "AntiVirusProduct"</P>Thu, 25 Jul 2019 14:40:11 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631523#M4786chealey2019-07-25T14:40:11ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631533#M4789
<P>there goes half of my day for the next two weeks.... Like every time I have to work with support and collect random logs. This issue is intermittent, it is not occurring 100% of the time......</P><P>I'll try to collect all that stuff when i have time.</P>Thu, 25 Jul 2019 14:57:55 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631533#M4789kylekat2019-07-25T14:57:55ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631699#M4816
<P>I'd like to save you the hassle and collect this myself but my test machine is not displaying this same behaviour. Sorry!</P>Mon, 29 Jul 2019 12:29:13 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/631699#M4816chealey2019-07-29T12:29:13ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633714#M5047
<P><LI-USER uid="206182"></LI-USER>This issue seems to be ramping up dramatically with my deployment of the July update repost version of ENS in combination with Windows 10 1903 may feature upgrade installation.</P><P>I will try to capture the plethora of logs you asked and create a ticket but its quite ridiculous that McAfee cannot work on this on their own.</P><P>Endpoint Security Threat Prevention 10.6.1.1666<BR />Endpoint Security Firewall 10.6.1.1340<BR />Endpoint Security Platform 10.6.1.1607<BR />Endpoint Security Web Control 10.6.1.1435<BR />Endpoint Security Adaptive Threat Protection 10.6.1.1421</P>Wed, 28 Aug 2019 20:41:10 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633714#M5047kylekat2019-08-28T20:41:10ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633738#M5053
Hey Kyle, I would happily work on this with data collected from my own machine but the problem is, I haven't been able to replicate this behaviour on my 1903 test machine yet. Appreciate your assistance to get this looked into.Thu, 29 Aug 2019 07:36:15 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633738#M5053chealey2019-08-29T07:36:15ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633791#M5073
<P>Hi&nbsp;<LI-USER uid="144639"></LI-USER>&nbsp;,</P>
<P>Firstly, <STRONG>Thank you</STRONG> for all the effort and time you are investing into this. I certainly agree that this activity of log collection and uploading them to the Service Request is exhausting to you and I really wish I could help you out reducing efforts to none or minimum, unfortunately, I have attempted both upgrade installation (from December installation to May update patch and then apply July repost and I also tried running a clean install of July update and I am unable to re produce the issue from my end. However, I have just come across another McAfee User I am working with who has this issue.</P>
<P>However, I am fairly confident this is a Cosmetic issue and would like to confirm it with only one step - an <STRONG>EICAR test</STRONG>. This should let us know why Windows Security Center is displaying the information this way.</P>
<P>Also, Can you please help me with value displayed in this key(if it exists)?</P>
<P><STRONG>Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{1006DC03-1FB1-9E52-7C81-F2FAB48962E3}</STRONG></P>
<P>If the "<STRONG>STATE</STRONG>" DWORD is any value other than <STRONG>397312</STRONG>, Please do let me know so that I can confirm the issue is same.</P>
<P>These 2 steps as stated above should give us a confirmation whether the issue is cosmetic or if it is affecting the product's functionality.</P>
<P>Also, If these values match, I will be checking this from my end with the Engineering team with the helps of logs I have collected from my client and see their recommendations are useful to you as well.</P>
<P>We really look forward to your kind response on this and my goal is to ensure you put minimal effort from your end considering you having tested out several scenarios already from your end. In case the information you provided does not match with what I have observed form the ticket I am already working on,then, I am afraid we may have to create a new ticket for you with all the required logs.</P>Thu, 29 Aug 2019 13:42:49 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633791#M5073AdithyanT2019-08-29T13:42:49ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633800#M5074
<P>Thank you <LI-USER uid="217298"></LI-USER> and <LI-USER uid="206182"></LI-USER>. I uplaoded more evidence to my ticket i've sent via private message, but here are some answers:</P><P>I did an eicar test file on a system experiencing the problem and it looks like Windows Defender blocked it instead of mcafee.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-08-29 073054.png" style="width: 999px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4512i5EB214E28F7265F0/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-08-29 073054.png" alt="Annotation 2019-08-29 073054.png" /></span></P><P>And the regkey:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-08-29 074140.png" style="width: 999px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4513i600EEA14C3010283/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-08-29 074140.png" alt="Annotation 2019-08-29 074140.png" /></span></P><P>&nbsp;</P>Thu, 29 Aug 2019 15:05:54 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633800#M5074kylekat2019-08-29T15:05:54ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633892#M5079
<P>Hi,</P>
<P>Just to keep the post updated, This case is being handled by Support and I am having a close watch over this. I will keep this updated once we receive an update on the troubleshooting from the ticket. Thank you&nbsp;<LI-USER uid="144639"></LI-USER>&nbsp; for taking your time and effort in creating a Service Request with us and uploading data as requested for troubleshooting.</P>Fri, 30 Aug 2019 07:08:58 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633892#M5079AdithyanT2019-08-30T07:08:58ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633913#M5081
<P>This is definitely not a cosmetic issue... Windows Security is running scans and functioning in addition to ENS...&nbsp; This includes the decrease in performance of running multiple anti-virus solutions.</P><P>However, I have noticed that Windows Security seems to crash frequently now, with the "Virus &amp; Threat Protection" "tile" in Windows Security indicating "Threat service has stopped. Restart it now." (which then causes windows to notify about NO antivirus because it thinks ALL are turned off...)</P><P>Furthermore, one thing support had me do was run</P><P>get-wmiobject -namespace "root\securitycenter2" -class "antivirusproduct"</P><P>in powershell.</P><P>It reveals that "Windows Defender" is registered once, and "McAfee Endpoint Security" is registered twice, with conflicting information.</P><P>IMHO, development should release a patch that uninstalls the errant duplicate provider (or removes all "McAfee Endpoint Security" and re-registers one), which I'm sure they know how to do because they do it during an uninstallation...</P><P>&nbsp;</P>Fri, 30 Aug 2019 13:01:45 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/633913#M5081billmoller2019-08-30T13:01:45ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634160#M5100
<P>Getting the same issue here too... We're only just transitioning from VSE to ENS &amp; doesn't appear to affect everyone.</P>Tue, 03 Sep 2019 06:17:00 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634160#M5100JayMan2019-09-03T06:17:00ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634162#M5101
<P>There are a few important things to note here:</P>
<P>1. If you are using windows 1809 and any ENS version lower than May Update, then this was a known issue and you need to upgrade ENS to at least May Update (KB91428)</P>
<P>2. If you have the July Repost, Windows 1903 and the notification is intermittent then please raise a new service request and quote&nbsp;KB91830. Support will then ask you for a specific set of data which will need to be supplied for an escalation to engineering.</P>Tue, 03 Sep 2019 07:34:14 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634162#M5101chealey2019-09-03T07:34:14ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634168#M5102
<P>So far I've seen this on 2 systems running 1809, though haven't manually checked all systems we've deployed to (around 60, mixed of 1607, 1809, server 2012/2016).</P><P>&nbsp;</P><P>Should be the latest releases of ENS as was deployed with McAfee consultant just last week. Will load up a SR tomorrow when back in the office.</P>Tue, 03 Sep 2019 09:11:01 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634168#M5102JayMan2019-09-03T09:11:01ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634269#M5119
we have this on over 100 clients that we have updated to latest release, support asking me for MER / ProcMon logs / AMtrace logs etc. This must by now be a known issue?Wed, 04 Sep 2019 08:52:21 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634269#M5119SteveWilkinson2019-09-04T08:52:21ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634270#M5120
note, all our clients doing this are upgrades, clean install seems fine.Wed, 04 Sep 2019 08:53:34 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634270#M5120SteveWilkinson2019-09-04T08:53:34ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634272#M5122
<P>Hey&nbsp;<LI-USER uid="204779"></LI-USER>&nbsp;</P>
<P>As I said a few posts ago:</P>
<P>"If you have the July Repost, Windows 1903 and the notification is intermittent then please raise a new service request and quote&nbsp;KB91830. Support will then ask you for a specific set of data which will need to be supplied for an escalation to engineering."</P>
<P>We have now seen a few escalations to engineering and so the issue is already being worked on but it would be great to get your SR to engineering as well so that you can be easily informed about the fix and that way you would be considered for POC testing if we get one for this issue. If you can't/ don't want to supply the data then I suggest you subscribe to&nbsp;KB91830 which we will be updating as soon as we have any further information.</P>Wed, 04 Sep 2019 09:08:11 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634272#M5122chealey2019-09-04T09:08:11ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634280#M5125
<P><LI-USER uid="204779"></LI-USER>did you find a good way to determine those who were experiencing the issue? I dont' fancy manually checking every client we've upgraded...</P><P>&nbsp;</P><P><LI-USER uid="206182"></LI-USER>&nbsp;I've loaded up my SR&nbsp; 4-20292464771. MER has been submitted &amp; arranging a remote session for support to collect more data. Have tried a full uninstall of ENS, reboot, re-install ENS (at this point it reports normally), then after a reboot its back to ENS being reported as off &amp; defender is enabled. From that point on we can temporarily 'fix' it by using the 'turn on' button in Security Providers window (usually need to press it twice); but the problem returns after a reboot.</P><P>So far i've only done this testing on my laptop. 3 of the others around me i've checked aren't having the issue so far. 1 other has has the issue originally after the upgrade, however I feel like they may not have rebooted.</P><P>&nbsp;</P><P>Cheers</P><P>&nbsp;</P><P>&nbsp;</P>Wed, 04 Sep 2019 10:24:24 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634280#M5125JayMan2019-09-04T10:24:24ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634281#M5126
Great, thank you! I have reached out to the assigned engineer and have advised on what needs to be gathered / checked so we can escalate to engineering. Your case is actually interesting because it's 1809 builds. So far I've only seen 1903 builds being affected.<BR /><BR />I'm glad to hear you've found a temporary solution even though it may not be useful for long. If we find anything better to use, I will update this thread.Wed, 04 Sep 2019 10:33:09 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634281#M5126chealey2019-09-04T10:33:09ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634284#M5127
my colleague created an SCCM query to identify them; get-mpcomputerstatus|select realtimeprotectionenabledWed, 04 Sep 2019 10:47:20 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634284#M5127SteveWilkinson2019-09-04T10:47:20ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634290#M5129
<P><LI-USER uid="206182"></LI-USER>&nbsp;I am not sure I u derstand why you say that 1809 is a novelty. When I started this very post I was not deploying May feature update yet and that is why I complained to support that the claim of "ens MAY update has been fixed" is utter nonsense. I have seen this with any combination of ens July or may update as well as with or without May feature upgrade for windows 10.&nbsp;</P><P>&nbsp;</P><P>It certainly became much worse once May Feature Upgrade started being released in my environments, but issue was there from before.</P>Wed, 04 Sep 2019 16:11:52 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634290#M5129kylekat2019-09-04T16:11:52ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634292#M5130
Only because so far via Technical Support I've only seen reports of 1903 machines being affected. It's slightly different to the known issue we saw and fixed with the May Update. The problem is (not passing blame here at all but just stating it) Microsoft keep changing their integration methods with the Security Center and this leaves us chasing after their changes to get ours integrated properly, this is why this keeps reappearing in different variations. Anyway, let's make sure the remote with you happens so we can get the data to engineering. I know they are talking about releasing a POC so if we can get yours to engineering, you'll be given access to this once it becomes available.Wed, 04 Sep 2019 12:23:06 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634292#M5130chealey2019-09-04T12:23:06ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634294#M5131
We have this on over 150 clients, they are majority 1809 (few 1803!)Wed, 04 Sep 2019 12:34:12 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634294#M5131SteveWilkinson2019-09-04T12:34:12ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634299#M5133
<P><LI-USER uid="206182"></LI-USER>,&nbsp;to be clear, at least for me re: KB91830; the issue is not "intermittent."&nbsp; KB91830 might need to be updated (unless I'm the only one experiencing this in a non-"intermittent" fashion).</P><P>In my case, ENS <EM>always</EM> shows as <STRONG>OFF</STRONG>.&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-09-04 084636.jpg" style="width: 454px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4535iD06291692B370426/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-09-04 084636.jpg" alt="Annotation 2019-09-04 084636.jpg" /></span></P><P>WSC does "intermittently" notify me that&nbsp;<EM>no</EM> anti-virus is enabled, but only because Windows Defender Antivirus seems to crash frequently now with "Threat service has stopped.&nbsp; Restart it now."</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-09-04 084519.jpg" style="width: 231px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4534i6E5C6B087F374038/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-09-04 084519.jpg" alt="Annotation 2019-09-04 084519.jpg" /></span></P><P>I believe it's crashing because the two AV services (WDA and ENS) are conflicting.</P><P>Can anyone else comment on whether the issue is "intermittent" for them, as KB98130 indicates?&nbsp; i.e. whether ENS is "intermittently" off vs. WSC "intermittently" <EM>reporting</EM> that ENS is off?</P><P>Since this issue started, ENS has never showed ON for me (unless I click the provider and click the "Turn On" button, which doesn't seem to do anything, because ENS is already on, and doesn't survive a reboot).</P>Wed, 04 Sep 2019 12:52:30 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634299#M5133billmoller2019-09-04T12:52:30ZWindows Defender and 10.6.1 JULY after Reboot ACTIVE (DUAL AV, Performance down)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634326#M5138
<P><FONT>McAfee Partner with over 30 EPO installations.</FONT></P><P><FONT>Windows 10 ENTERPRISE LTSC, 1809, BUILD 17763.592, EN, German MUI</FONT></P><P><FONT>FRESH Install 10.6.1 JULY <STRONG>OR</STRONG> migrated from ENS 10.6.1 MAY&nbsp;</FONT></P><P><FONT>* McAfee DXL Client&nbsp; 5.0.1.249&nbsp;&nbsp;&nbsp;<BR />* Endpoint Security Adaptive Threat Protection&nbsp; 10.6.1.1421&nbsp;&nbsp;&nbsp;<BR />* Endpoint Security Threat Prevention&nbsp; 10.6.1.1666&nbsp;&nbsp;&nbsp;<BR />* Endpoint Security Platform&nbsp; 10.6.1.1607&nbsp;&nbsp;<BR />* Agent&nbsp; 5.6.1.308&nbsp;&nbsp; </FONT></P><P><FONT>* EPO 5.9.1, all Hotfixes</FONT></P><P>&nbsp;</P><P><FONT>Procedure to force ERROR (Satte that two AV are running)</FONT></P><P>&nbsp;</P><P><FONT>1) Deploye Comes with Agent 5.6.1.308 and ENS as above</FONT></P><P><FONT>2) All is fine "2 x Windows Defender Antivirus Service DOWN", "1 x Windows Defender Firewall UP"</FONT></P><P><FONT>3) REBOOT</FONT></P><P><FONT>4) Windows 10 DOES not SEE MCAFEE and THUS makes Windows Defender active</FONT></P><P><FONT>5) STATE ENS 10.6.1 all MODULES and Windows Defender AT SAME TIME RUN and SLOW down performance.</FONT></P><P><FONT>6) If you TAKE down the MCAFEE ON ACCESS SCAN &gt; Windows Sees it and shut out, If you turn on ACCESSS SCAN all is fine again.</FONT></P><P><FONT>7) Reboot SAME from starting</FONT></P><P>&nbsp;</P><P><FONT>This is a major Problem please resolve ASAP.</FONT></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P>Wed, 04 Sep 2019 16:04:28 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634326#M5138SWISS2019-09-04T16:04:28ZRe: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks inhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634327#M5139
<P><SPAN>"Only because so far via Technical Support I've only seen reports of 1903 machines"</SPAN></P><P>&nbsp;</P><P><SPAN>Also happens on:</SPAN></P><P><SPAN>Windows 10 ENTERPRISE LTSC, 1809, BUILD 17763.592, EN, German MUI</SPAN></P><P>&nbsp;</P>Wed, 04 Sep 2019 16:09:46 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634327#M5139SWISS2019-09-04T16:09:46ZRe: Windows Defender and 10.6.1 JULY after Reboot ACTIVE (DUAL AV, Performance down)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634367#M5141
<P>I can only repeat myself. Please raise a Service Request so we can work with you to gather appropriate data and can escalate to engineering swiftly. As I've said in previous answers, I know Engineering already have a few reports (so far only 1903 but based on the responses here it seems other builds are also affected) and I can advise that Engineering are already working on a fix. Once your SR is with Engineering we would be able to provide a POC once available to confirm that we'll be fixing your issue in the next release as expected.</P>Thu, 05 Sep 2019 07:25:38 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634367#M5141chealey2019-09-05T07:25:38ZRe: Windows Defender and 10.6.1 JULY after Reboot ACTIVE (DUAL AV, Performance down)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634376#M5142
<P><SPAN>Service Requests 4-20295857151 </SPAN></P><P><SPAN>McAfee, partners other people with the same problem: </SPAN></P><P><SPAN>Please post the information and possible HOTFIX availability right here.</SPAN></P><P>&nbsp;</P><P>&nbsp;</P>Thu, 05 Sep 2019 09:35:06 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634376#M5142SWISS2019-09-05T09:35:06ZRe: Windows Defender and 10.6.1 JULY after Reboot ACTIVE (DUAL AV, Performance down)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634377#M5143
Thank you for sharing the SR number. I've reached out to the Owner of the case with the required items/ checks for the escalation to Engineering. I will keep monitoring it to ensure quick progression.<BR />I will of course try to keep this thread up to date but I would encourage you to monitor KB91830 as this is where we will be sharing information officially.Thu, 05 Sep 2019 09:44:20 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634377#M5143chealey2019-09-05T09:44:20ZRe: Windows Defender and 10.6.1 JULY after Reboot ACTIVE (DUAL AV, Performance down)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634392#M5146
<P>How to check whether Windows Defender is disabled after installing Endpoint Security Threat Prevention</P><DIV><DIV>Technical Articles ID: &nbsp;&nbsp;KB88214<BR />Last Modified:&nbsp;&nbsp;7/19/2018<BR />Rated:<DIV class="im-icon"><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV></DIV></DIV></DIV><HR /><DIV class="attr CORP_ENVIRONMENT">Environment<DIV class="content">McAfee Endpoint Security (ENS) Threat Prevention 10.x</DIV></DIV><DIV class="attr CORP_SUMMARY">Summary<DIV class="content">As per the Windows Anti-Malware agreement, McAfee is not supposed to uninstall Windows Defender on Windows systems. We integrate with Windows Action Center (WAC) and when WAC sees that ENS Threat Prevention is installed, it disables Windows Defender.<BR /><BR />Perform the following steps to check whether Windows Defender is disabled after installing ENS Threat Prevention:<OL><LI>Open the <STRONG>Control Panel</STRONG> and check the status of <STRONG>Windows Defender</STRONG>.</LI><LI>Check the status of the Windows Defender services:<OL><LI>Press CTRL+ALT+DEL, and then select <STRONG>Task Manager</STRONG>.</LI><LI>Click the <STRONG>Services</STRONG> tab.</LI><LI>Check the status of the following services:<DIV>&nbsp;</DIV><STRONG>Windows Defender Network Inspection Service<BR />Windows Defender Service</STRONG></LI></OL></LI></OL><DIV>The Control Panel should show that Windows Defender is disabled and the Windows Defender services should be stopped. If the Windows Defender services are stopped, but the Control Panel is showing that Windows Defender is enabled, it is a system issue.</DIV></DIV></DIV><P>&nbsp;</P>Thu, 05 Sep 2019 15:37:17 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634392#M5146SWISS2019-09-05T15:37:17ZRe: Windows Defender and 10.6.1 JULY after Reboot ACTIVE (DUAL AV, Performance down)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634396#M5147
<P>ENS and WDA are definitely running concurrently:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-09-05 114211.jpg" style="width: 467px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4540i2131F0B42A56AE84/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-09-05 114211.jpg" alt="Annotation 2019-09-05 114211.jpg" /></span></P>Thu, 05 Sep 2019 15:44:10 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634396#M5147billmoller2019-09-05T15:44:10ZRe: Windows Defender and 10.6.1 JULY after Reboot ACTIVE (DUAL AV, Performance down)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634521#M5160
<P>The clients of the customer having the effrct use following ISO:</P><P>&nbsp;</P><P>SW_DVD5_WIN_ENT_LTSC_2019_64-bit_German_MLF_X21-96437.ISO</P><P>&nbsp;</P><P>W10</P><P>Enterprise</P><P>LTSC</P><P>2019</P><P>64BIT</P><P>GERMAN</P><P>REFRESH</P><P>VL</P><P>&nbsp;</P>Mon, 09 Sep 2019 07:50:15 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634521#M5160SWISS2019-09-09T07:50:15ZRe: Windows Defender and 10.6.1 JULY after Reboot ACTIVE (DUAL AV, Performance down)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634523#M5161
<P>Something interesting I've found while trying to collect additional logs for support... I can't reproduce the error while ENS is set for debug logging &amp; full access to client interface.</P><P>&nbsp;</P><P>Still need to test which of these 2 setting makes the diffedence (or both?).</P>Mon, 09 Sep 2019 07:59:35 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634523#M5161JayMan2019-09-09T07:59:35ZRe: Windows Defender and 10.6.1 JULY after Reboot ACTIVE (DUAL AV, Performance down)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634532#M5162
<P>Ah so it's 4 people (CUSTOMERS) working now for Mcafee to solve their product bug?</P><P>What's that called social support? How about social pricing?</P>Mon, 09 Sep 2019 09:07:24 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634532#M5162SWISS2019-09-09T09:07:24ZWINDOWS DEFENDER + ENS 10.6.1 + W10 LTSC 2019 ENT GER 64BIT VL problem AMSIhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634552#M5165
<P>Hello,</P><P>We have found the PART which makes it:</P><P>It's the AMSI Option.&nbsp;</P><P>&nbsp;</P><P>All we know at 14:28 O'Clock 09.09.2019</P><P>* ISO: SW_DVD5_WIN_ENT_LTSC_2019_64-bit_German_MLF_X21-96437.ISO</P><P>* Fresh install from ISO ESX 6.5, E1000, No VMWARE Tool, Domain JOINED, NO GPO, NO other soft</P><P>* Reboot</P><P>* OK &gt;Windows Defender Services <STRONG>UP</STRONG></P><P>* Push Agent 5.6.1.308 &gt; Reboot (Client IN NEW OU in EPO with Default Mcafee Policy)</P><P><SPAN>* OK &gt; Windows Defender Services <STRONG>UP</STRONG></SPAN></P><P><SPAN>* Push ENS 10.6.1 (Plattform, Exploit + ATP Module [No Firewall Module]) &gt; Reboot</SPAN></P><P><SPAN>* OK &gt; Windows Defender Services <STRONG>DOWN (Except Firewall) &gt; OK</STRONG></SPAN></P><P><SPAN>* Assign Stepwise Policy from Productive</SPAN></P><P><SPAN>* When we APPLY Policy ON-ACCES-SCAN and ENABLE AMSI BOX the effect comes</SPAN></P><P><SPAN>*<STRONG> ERROR &gt; Windows Defender Services UP (Except Firewall) &gt; OK</STRONG></SPAN></P><P><SPAN><STRONG>* ERROR &gt; Warning from W10</STRONG></SPAN></P><P>&nbsp;</P><P><STRONG><SPAN>Now to NOT complete MISSUNDERSTAND and Maybe it should be like that? But nobody told all the people who had cases open?</SPAN></STRONG></P><P><SPAN>Now when AMSI is working or AMSI is enabled should the Service "<FONT>Windows Defender Antivirus Service</FONT>" be running or NOT?? (Can it RUN and then TURN off). Is this by feature and how it should be?</SPAN></P><P><SPAN>On the machines WE HAD the effect this ONLY showed UP shortly after Reboot BUT then slowing down logon and GPO extreme.</SPAN></P><P>It happens if you have the AMSI report only or sharp/active.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2019-09-09 14_25_26-local - visionapp Remote Desktop 2010.png" style="width: 609px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4560i37D2218368436034/image-size/large?v=1.0&amp;px=999" title="2019-09-09 14_25_26-local - visionapp Remote Desktop 2010.png" alt="2019-09-09 14_25_26-local - visionapp Remote Desktop 2010.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P>Mon, 09 Sep 2019 12:39:01 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634552#M5165SWISS2019-09-09T12:39:01ZRe: WINDOWS DEFENDER + ENS 10.6.1 + W10 LTSC 2019 ENT GER 64BIT VL problem AMSIhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634567#M5169
<P>We have AMSI on (enforced, not obvserve), but not sure its a factor. AMSI quite possibly does rely on the Defender service itself as it stems from Windows functionality (basically windows passes the script from memory to the AV for traditional scanning, which would otherwise be missed since its never in a file).</P><P>&nbsp;</P><P>So far i've got 3 confirmed systems where this is repeatable on... and 1 that doesn't appear to show the issue (with the same OS build &amp; ENS policies)... Very weird. We have a lot more deployments of ENS, but not enough time to go check each one individually to see if they're behaving the same for now... Nobody else is complaining, but in our case we aren't getting any AV not running popups, because Defender doesn't crash... both 'happily' run together.</P>Mon, 09 Sep 2019 12:53:32 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634567#M5169JayMan2019-09-09T12:53:32ZRe: WINDOWS DEFENDER + ENS 10.6.1 + W10 LTSC 2019 ENT GER 64BIT VL problem AMSIhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634581#M5170
<P><SPAN>We have AMSI on (enforced) on over 20 EPO Onpremise customers with all ENS 10.6.1 JULY Repost and Agent 5.6.3.108. Just finished updating all of them. The client base runs from around 900 clients with the same clients to SBS/KMU with different W10 Versions PRO/ENT 1809/17XX and 1903 in place.</SPAN></P><P><SPAN>All of them we trurned AMSI on as you mentioned.</SPAN></P><P><SPAN>This is one of the first W10 LTSC 2019 we have in place and on VDI. Maybe the reason why we discovered it because we take an extreme close look to performance with that customer.</SPAN></P><P>&nbsp;</P><P><SPAN>We several times in Mcafee forums asked on MORE info regarding AMSI and ENS. Esp. we woul dlike to know more info on LOG / DEBUG / Trace if something goes wrong outside the Mcafee components.</SPAN></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P>Mon, 09 Sep 2019 14:03:30 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634581#M5170SWISS2019-09-09T14:03:30ZRe: WINDOWS DEFENDER + ENS 10.6.1 + W10 LTSC 2019 ENT GER 64BIT VL problem AMSIhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634647#M5179
<P>I've tried with AMSI disabled today &amp; the issue continues... So thats not the cause, at least in my instance.</P><P>&nbsp;</P><P>Windows only seems to detect ENS correctly on my laptop after a reboot when debug logging is enabled for threat prevention.</P>Tue, 10 Sep 2019 04:21:25 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634647#M5179JayMan2019-09-10T04:21:25ZRe: WINDOWS DEFENDER + ENS 10.6.1 + W10 LTSC 2019 ENT GER 64BIT VL problem AMSIhttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634710#M5191
<P>I also tried with:</P><UL><LI>AMSI on with Observe</LI><LI>AMSI on without Observe (I guess this means enforce)</LI><LI>AMSI off</LI></UL><P>The issue continued in all three scenarios (with "Check New Policies" and reboots in between).</P><P>About to try with TP debug logging on as suggested by&nbsp;<LI-USER uid="35194"></LI-USER>&nbsp;</P><P>&nbsp;</P>Tue, 10 Sep 2019 16:33:39 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634710#M5191billmoller2019-09-10T16:33:39ZWorkaround! (props to JayMan)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634717#M5192
<P><LI-USER uid="35194"></LI-USER>&nbsp;is definitely on to something...</P><P>I tried to reproduce&nbsp;<LI-USER uid="35194"></LI-USER>&nbsp;'s results by enabling debug logging for “ENS Common – Options" as follows:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="debug on in policy.png" style="width: 488px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4570iF6E58EAF2FB09239/image-size/large?v=1.0&amp;px=999" title="debug on in policy.png" alt="debug on in policy.png" /></span></P><P>With debug logging on, the problem seems to have completely disappeared after a reboot (and survived a subsequent reboot).</P><P>get-wmiobject -namespace "root\securitycenter2" -class "antivirusproduct"</P><P>now returns the following for ENS:</P><P>__GENUS : 2<BR />__CLASS : AntiVirusProduct<BR />__SUPERCLASS :<BR />__DYNASTY : AntiVirusProduct<BR />__RELPATH : AntiVirusProduct.instanceGuid="{1006DC03-1FB1-9E52-7C81-F2FAB48962E3}"<BR />__PROPERTY_COUNT : 6<BR />__DERIVATION : {}<BR />__SERVER : DEL7810-0219<BR />__NAMESPACE : ROOT\securitycenter2<BR />__PATH : \\DEL7810-0219\ROOT\securitycenter2:AntiVirusProduct.instanceGuid="{1006DC03-1FB1-9E52-7C81-<BR />F2FAB48962E3}"<BR />displayName : McAfee Endpoint Security<BR />instanceGuid : {1006DC03-1FB1-9E52-7C81-F2FAB48962E3}<BR />pathToSignedProductExe : C:\Program Files (x86)\McAfee\Endpoint Security\Threat Prevention\AMCFG.EXE<BR />pathToSignedReportingExe : C:\Program Files\McAfee\Endpoint Security\Threat Prevention\mfeensppl.exe<BR /><FONT color="#FF0000">productState : 397312</FONT><BR />timestamp : Tue, 10 Sep 2019 16:41:06 GMT<BR />PSComputerName : DEL7810-0219</P><P>Note the different productState (normally is&nbsp;393232).</P><P>I then tried to dumb down the "debug on" settings as much as I could in my ENS Common - Options policy:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="workaround.png" style="width: 477px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4571i805AEBA9F149452E/image-size/large?v=1.0&amp;px=999" title="workaround.png" alt="workaround.png" /></span></P><P>After multiple reboots, this&nbsp;<EM>workaround</EM> still works!&nbsp; productState remains 397312, WSC detects McAfee as <STRONG>on</STRONG>, and therefore leaves WDA <STRONG>off</STRONG>.</P><P>Now, in&nbsp;C:\ProgramData\McAfee\Endpoint Security\Logs, the following files are randomly written to frequently:</P><UL><LI>EndpointSecurityPlatform_Debug</LI><LI>SelfProtection_Debug</LI><LI>ThreatPrevention_Debug</LI></UL><P>However, I must assume that this is less of a performance impact than two anti-virus solutions running simultaneously.</P><P>Can others confirm this&nbsp;<EM>workaround?</EM></P><P>I will forward this post to my SR as well.</P>Tue, 10 Sep 2019 18:04:58 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634717#M5192billmoller2019-09-10T18:04:58ZRe: Workaround! (props to JayMan)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634763#M5201
<P>Very interesting indeed! This actually explains why I couldn't reproduce it on my test machine - I have debug logging enabled by default. I'm taking it up with Engineering to see if this is something we've already identified as part of our investigation.&nbsp;</P>
<P>Thank you for your input and for sharing!</P>Wed, 11 Sep 2019 07:44:17 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634763#M5201chealey2019-09-11T07:44:17ZRe: Workaround! (props to JayMan)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634768#M5204
<LI-USER uid="206182" login="chealey"></LI-USER>,<BR /><BR />Please escalate SR 4-20295857151. This is 900 Endpoint valued Enterprise customer. And it stills hangs at Sophia Support.Wed, 11 Sep 2019 08:07:28 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634768#M5204SWISS2019-09-11T08:07:28ZRe: Workaround! (props to JayMan)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634771#M5205
<DIV><FONT>Because of performance</FONT></DIV><DIV>&nbsp;</DIV><DIV><FONT>You can Limit the DEBUG LOGFILES so this should be ok. The effect that both run under LTSC W10 is not persitent. We could only see the effect after reboot by example. We are at a stage where <LI-USER uid="206182" login="chealey"></LI-USER> found out that he HAD Debug Mode on his Test enviroment on AND Mcafee thise could never reproduce the effect. </FONT></DIV><DIV>&nbsp;</DIV><DIV><FONT>In our case SR 4-20295857151 on a remote session the Person from Sophia did SEE that both are running BUT at that part of Mcfaee they where NOT SURE if this is even how it sometimes SHOULD/COULD be. If you look at a Diagramm which shows the Windows Defender API and AMSI you see that those are Connected.</FONT></DIV><DIV>&nbsp;</DIV><DIV><FONT>That's why we Primary searched in the directon of AMSI.</FONT></DIV><DIV>&nbsp;</DIV><DIV><FONT>In the meantime we have a second enterprise customer who has the effect on 1709 W10 ENT German.</FONT></DIV><DIV><FONT>They did not notice the performance delay however or nobody reported to us.</FONT></DIV><DIV>&nbsp;</DIV><DIV><FONT><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2019-09-11 10_25_26-Gesendete Objekte - m.butsch@ibitech.com - Outlook.png" style="width: 999px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4578iCD6EA3FF51637A52/image-size/large?v=1.0&amp;px=999" title="2019-09-11 10_25_26-Gesendete Objekte - m.butsch@ibitech.com - Outlook.png" alt="2019-09-11 10_25_26-Gesendete Objekte - m.butsch@ibitech.com - Outlook.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="neu_2019-09-11 10_26_57-C__edv_2019-09-11 10_25_26-Gesendete Objekte - m.butsch@ibitech.com - Outlook.pn.png" style="width: 999px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4579i1724BF1CA768DD19/image-size/large?v=1.0&amp;px=999" title="neu_2019-09-11 10_26_57-C__edv_2019-09-11 10_25_26-Gesendete Objekte - m.butsch@ibitech.com - Outlook.pn.png" alt="neu_2019-09-11 10_26_57-C__edv_2019-09-11 10_25_26-Gesendete Objekte - m.butsch@ibitech.com - Outlook.pn.png" /></span></FONT></DIV>Wed, 11 Sep 2019 08:29:58 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634771#M5205SWISS2019-09-11T08:29:58ZRe: Workaround! (props to JayMan)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634773#M5206
Your response here is not quite correct - I could not reproduce it on my test systems. Not necessarily anyone in McAfee.<BR />We are working on the appropriate SRs to gather the correct data for escalation and are talking directly to our engineering team. As I said, so far all the escalations I've seen are still all 1903 systems. The other ones seen so far, have all been red herrings. I've also already spoken directly to the owner of your case.<BR />Wed, 11 Sep 2019 08:41:56 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634773#M5206chealey2019-09-11T08:41:56ZRe: Workaround! (props to JayMan)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634802#M5209
<P><LI-USER uid="206182"></LI-USER>&nbsp;, if I had to guess... Windows is misinterpreting productState 393232 as "off" or McAfee needs to correct the productState...</P>Wed, 11 Sep 2019 13:07:00 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634802#M5209billmoller2019-09-11T13:07:00ZRe: Workaround! (props to JayMan)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634806#M5210
Yes, this does seem to be what I've noticed as well. Engineering should have resolved this now for the next release. There may be an Early Release version soon which would be available to customers who have raised a Service Request for testing purposes. This would help validate that the changes we've made, fix all variations of the issue that we keep seeing reported - especially here on the community.Wed, 11 Sep 2019 13:46:34 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634806#M5210chealey2019-09-11T13:46:34ZRe: Workaround! (props to JayMan)https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634823#M5218
<P>Why do we Need a NEW release if there IS no Problem?</P><P>Once again for all of us who have customer who spend fortune in mcafee? Customer WHO are affected and have a acase open by the problem will have to request a Release to Support once the developers take care off?&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P>Wed, 11 Sep 2019 15:25:58 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634823#M5218SWISS2019-09-11T15:25:58ZHAPPENS on 1709 toohttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634832#M5223
<P><LI-USER uid="206182"></LI-USER>&nbsp;</P><P>Need more info. This is another customer with 1709? Happens in W10 LTSC happens in W10 1709 ENT VL. Need more? Tell the Partner (US).</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2019-09-11 17_41_45-local - visionapp Remote Desktop 2010.png" style="width: 999px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4583i4E71A23D01B27AE1/image-size/large?v=1.0&amp;px=999" title="2019-09-11 17_41_45-local - visionapp Remote Desktop 2010.png" alt="2019-09-11 17_41_45-local - visionapp Remote Desktop 2010.png" /></span></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2019-09-11 17_44_20-local - visionapp Remote Desktop 2010.png" style="width: 938px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4584i4FCE5E44C7B09FC5/image-size/large?v=1.0&amp;px=999" title="2019-09-11 17_44_20-local - visionapp Remote Desktop 2010.png" alt="2019-09-11 17_44_20-local - visionapp Remote Desktop 2010.png" /></span></P>Wed, 11 Sep 2019 15:46:09 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634832#M5223SWISS2019-09-11T15:46:09ZIS it in any way related top WSUS Updates Windows Defender Platform Updates?https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634883#M5235
<P><FONT>IS it in any way related top WSUS Updates Windows Defender Platform Updates like405623</FONT></P><P><FONT>Just to explain. Years ago we did not aprove those to clients. With the AMSI coming in we started to deploy those updates again. We also had some issues with other software if we did not update them on clients.</FONT></P><P><FONT><A href="https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform" target="_blank" rel="noopener">https://support.microsoft.com/en-us/help/4052623/update-for-windows-defender-antimalware-platform</A></FONT></P><P><FONT><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2019-09-12 11_09_59-local - visionapp Remote Desktop 2010.png" style="width: 589px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4591i7BB1ED5078EE44F5/image-size/large?v=1.0&amp;px=999" title="2019-09-12 11_09_59-local - visionapp Remote Desktop 2010.png" alt="2019-09-12 11_09_59-local - visionapp Remote Desktop 2010.png" /></span></FONT></P><P>&nbsp;</P><P><SPAN class="x-hidden-focus">File location changes</SPAN></P><P class="ng-scope">This update makes the following binary location changes.</P><TABLE><TBODY><TR><TD><STRONG>Affected component</STRONG></TD><TD><STRONG>Old location</STRONG></TD><TD><STRONG>New location</STRONG></TD></TR><TR><TD><P>Windows Defender Antivirus service (MsMpEng.exe)</P><P>Network Realtime Inspection service (NisSrv.exe)</P></TD><TD>%ProgramFiles%\Windows Defender</TD><TD>%ProgramData%\Microsoft\Windows Defender\Platform\&lt;Version&gt;</TD></TR><TR><TD>Windows Defender Antivirus drivers</TD><TD><P>%Windir%\System32\drivers&nbsp;</P></TD><TD>%Windir%\System32\drivers\wd</TD></TR></TBODY></TABLE><P class="ng-scope x-hidden-focus"><BR />All third-party applications that have references to these binaries must be updated to the new locations.</P>Thu, 12 Sep 2019 09:15:44 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634883#M5235SWISS2019-09-12T09:15:44ZWorkaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634909#M5238
<P>This morning, everything was working fine (with debug workaround on).&nbsp; Then I saw the following notification:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-09-12 085023.png" style="width: 387px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4595iA3C0F143F9FEB2C7/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-09-12 085023.png" alt="Annotation 2019-09-12 085023.png" /></span></P><P>I immediately checked the McAfee Agent Status Monitor:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-09-12 085047.png" style="width: 481px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4596i8618E69DCFD2C69E/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-09-12 085047.png" alt="Annotation 2019-09-12 085047.png" /></span></P><P>An update was happening at that time.&nbsp; However, when I clicked into WSC, it was showing both ENS and WDA were OFF (when ENS is actually on):</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-09-12 091656.png" style="width: 290px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4597i211EAD0C64BA0AA0/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-09-12 091656.png" alt="Annotation 2019-09-12 091656.png" /></span></P><P>Ran the following again:</P><P>PS Z:\&gt; get-wmiobject -namespace "root\securitycenter2" -class "antivirusproduct"</P><P><BR />__GENUS : 2<BR />__CLASS : AntiVirusProduct<BR />__SUPERCLASS :<BR />__DYNASTY : AntiVirusProduct<BR />__RELPATH : AntiVirusProduct.instanceGuid="{1006DC03-1FB1-9E52-7C81-F2FAB48962E3}"<BR />__PROPERTY_COUNT : 6<BR />__DERIVATION : {}<BR />__SERVER : DEL7810-0219<BR />__NAMESPACE : ROOT\securitycenter2<BR />__PATH : \\DEL7810-0219\ROOT\securitycenter2:AntiVirusProduct.instanceGuid="{1006DC03-1FB1-9E52-7C81-<BR />F2FAB48962E3}"<BR />displayName : McAfee Endpoint Security<BR />instanceGuid : {1006DC03-1FB1-9E52-7C81-F2FAB48962E3}<BR />pathToSignedProductExe : C:\Program Files (x86)\McAfee\Endpoint Security\Threat Prevention\AMCFG.EXE<BR />pathToSignedReportingExe : C:\Program Files\McAfee\Endpoint Security\Threat Prevention\mfeensppl.exe<BR /><FONT color="#FF0000">productState : 393232</FONT><BR />timestamp : Thu, 12 Sep 2019 12:48:33 GMT<BR />PSComputerName : DEL7810-0219</P><P>Product state had reverted to 393232 even with debug on in policy and the actual ENS product:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-09-12 091849.png" style="width: 480px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4599iFA59FC8B0D850846/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-09-12 091849.png" alt="Annotation 2019-09-12 091849.png" /></span></P><P>... so I don't know what's going on anymore, and it looks like the&nbsp;<EM>workaround</EM> can be defeated by an auto-update changing the product state back to 393232...</P><P>:: throws hands up in the air ::</P>Thu, 12 Sep 2019 13:21:08 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634909#M5238billmoller2019-09-12T13:21:08ZRe: Workaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634911#M5240
<P>I noticed this issue over the last few days as 1903 has been rolling out to the systems in my org,. Systems are now agent 5.6.2.206 and the elements from the 1340 bundle and the symptoms persists. Enabling debug logging as described earlier did 'fix' the issue until the systems were rebooted. So add me to the list of people waiting for McAfee to resolve this properly.</P>Thu, 12 Sep 2019 17:20:10 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634911#M5240meanoldmanning2019-09-12T17:20:10ZRe: Workaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634954#M5243
Best bet would be to load up an SR. You could mention this thread &amp; also post your SR number here so <LI-USER uid="206182" login="chealey"></LI-USER> can link it up with everyone else' SR's.<BR /><BR />Pretty sure I posted mine already (affecting 1809 systems) but here it is again - 4-20292464771Thu, 12 Sep 2019 22:45:34 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634954#M5243JayMan2019-09-12T22:45:34ZRe: Workaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634969#M5245
<P>Same problems here after upgrading to Windows 1903. We have latest 10.6.1 July patch release and Agent 5.6.2.</P><P>I hope McAfee fixes this soon!</P>Fri, 13 Sep 2019 08:14:06 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/634969#M5245ilukeberry2019-09-13T08:14:06ZRe: Workaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635011#M5253
<P>my service request is&nbsp;<SPAN> 4-20314399451</SPAN></P>Fri, 13 Sep 2019 14:06:44 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635011#M5253meanoldmanning2019-09-13T14:06:44ZRe: Workaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635012#M5254
<P>my SR: 4-20313291201</P>Fri, 13 Sep 2019 14:08:13 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635012#M5254ilukeberry2019-09-13T14:08:13ZRe: Workaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635015#M5255
<P>Thank you&nbsp;<LI-USER uid="217692"></LI-USER>&nbsp;<LI-USER uid="4012"></LI-USER>&nbsp;</P>
<P>I've reached out to the owners of your cases.</P>Fri, 13 Sep 2019 14:16:19 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635015#M5255chealey2019-09-13T14:16:19ZRe: Workaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635016#M5256
<P>Well I got this reply from support:</P><P>&nbsp;</P><P><EM>This is a know issue to us, This issue will be resolved in a future version of ENS.</EM></P><P><EM>As of now we do not have exact date of the release. You have subscribe to the page and you will get a notification when the product is released (KB91830)</EM></P>Fri, 13 Sep 2019 14:18:13 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635016#M5256ilukeberry2019-09-13T14:18:13ZRe: Workaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635017#M5257
<P>ENS 10.6.1 July Update worked fine with 1803.. The problems with this annoying WSC notification started after we rolled 1903 across organization.</P>Fri, 13 Sep 2019 14:20:34 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635017#M5257ilukeberry2019-09-13T14:20:34ZRe: Workaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635018#M5258
<P>ahh sorry it worked fine with 1809 <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P>Fri, 13 Sep 2019 14:22:37 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635018#M5258ilukeberry2019-09-13T14:22:37ZRe: Workaround update...https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635021#M5259
<P>Thanks&nbsp;<LI-USER uid="206182"></LI-USER> I spoke with the fellow assigned to my case, will wait for the fix to be issued.</P><P>I did point out a weird anomaly that I ran into on one of the systems I manage, the one I use actually. a couple days ago when I started to see this issue becoming more widespread in my org I was downloading a file from another software company and Windows Defender jumped in and scanned the download, informing me I would have to wait for up to 10 seconds, blah, blah, blah. Anyway, it did this several times while I was downloading files. It has not happened since and I have not been able to trigger it by reproducing the same scenario. Has anyone else seen this? It is obviously outside the scope of this currently issue being a reporting issue only as clearly Windows Defender was still running alongside ENS.</P>Fri, 13 Sep 2019 15:34:11 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635021#M5259meanoldmanning2019-09-13T15:34:11ZWindows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635489#M5305
<P>There seemed a Problem with Windows Defender only scanning 20 files instead of all <U>before</U> 09/2019 (SEP) patches. This may ALSO be releated to the current Problem we have with MCAFEE and WINDOWS DEFENDER. (Would only be Logical).</P><P>&nbsp;</P><P><FONT><A href="https://www.bleepingcomputer.com/news/microsoft/windows-defender-antivirus-scans-broken-after-new-update/" target="_blank" rel="noopener">https://www.bleepingcomputer.com/news/microsoft/windows-defender-antivirus-scans-broken-after-new-update/</A></FONT></P><P><FONT><A href="https://www.heise.de/security/meldung/Wichtiges-Update-Windows-Defender-scannte-nur-wenige-Dateien-4533669.html" target="_blank" rel="noopener">https://www.heise.de/security/meldung/Wichtiges-Update-Windows-Defender-scannte-nur-wenige-Dateien-4533669.html</A></FONT></P><P>&nbsp;</P><P><FONT>Then there is a TREND related to Windows Defender KB from SEP 4th 2019. For anyone says it's Mcafee again <span class="lia-unicode-emoji" title=":winking_face:">😉</span> The KB is related to some Reboot Flag but still i think this is DUE the Update of Windows Defender Engine from Patchday 08/2019</FONT></P><P><FONT><A href="https://success.trendmicro.com/solution/1123730-restart-notification-in-officescan-does-not-reset" target="_blank" rel="noopener">https://success.trendmicro.com/solution/1123730-restart-notification-in-officescan-does-not-reset</A></FONT></P>Thu, 19 Sep 2019 10:35:46 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635489#M5305SWISS2019-09-19T10:35:46ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635922#M5368
<P>We too have noticed that the systems updating the AMCore content causes it to flip out and the message to appear in Windows Security Centre.</P><P><LI-USER uid="206182"></LI-USER>&nbsp;</P><P>SR:&nbsp;4-20235642401</P>Tue, 24 Sep 2019 09:35:42 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635922#M5368LBX2019-09-24T09:35:42ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635923#M5369
<P>Thank you&nbsp;<LI-USER uid="217911"></LI-USER>&nbsp;</P>
<P>I will also reach out to the owner of your case. This issue will be addressed in the next release of the product which is targeted for October.</P>Tue, 24 Sep 2019 09:39:25 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635923#M5369chealey2019-09-24T09:39:25ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635927#M5370
Thanks for the update!<BR /><BR />Would it be possible to have any RTS version of the fix in advance of a global release?Tue, 24 Sep 2019 09:51:20 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635927#M5370LBX2019-09-24T09:51:20ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635928#M5371
<P>We don't have any confirmation yet on a RTS or EA (Early Access) build. I can see your case is already being sent to engineering, it is possible that they may share a POC for testing but the owner of your case will keep you informed.</P>Tue, 24 Sep 2019 09:54:13 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/635928#M5371chealey2019-09-24T09:54:13ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636623#M5482
<P>So the verdict is the application is bugged and will be fixed in the next ENS release?</P><P><A href="https://kc.mcafee.com/agent/index?page=content&amp;id=KB91830" target="_blank">https://kc.mcafee.com/agent/index?page=content&amp;id=KB91830</A></P><P>smh....</P><P>&nbsp;</P>Tue, 01 Oct 2019 19:16:42 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636623#M5482kylekat2019-10-01T19:16:42ZPlease update https://kc.mcafee.com/agent/index?page=content&id=KB91830https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636673#M5484
<P>It would honestly be more reassuring that the issue is being worked on if the kb article is updated to reflect when an expected release date of the fix will be. It has not been updated since it was first published in August.</P>Wed, 02 Oct 2019 08:04:41 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636673#M5484LBX2019-10-02T08:04:41ZRe: Please update https://kc.mcafee.com/agent/index?page=content&id=KB91830https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636674#M5485
<P>Hi&nbsp;<LI-USER uid="217911"></LI-USER>&nbsp;</P>
<P>I fully understand your concern however the KB won't be updated until the fix has been delivered. Typically we would update the KB with information relevant to the issue, however in this unique scenario we don't see any error messages we can point out to you for reference. Hence the KB is quite generic.</P>Wed, 02 Oct 2019 08:09:14 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636674#M5485chealey2019-10-02T08:09:14ZRe: Please update https://kc.mcafee.com/agent/index?page=content&id=KB91830https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636682#M5486
<P>This <U>no</U>t a UNIQUE Scenario and most of our customers are affected. It depends on how often you update AMCORE with a TASK and IF user notice the delay and report it.</P><P>Please update the KB so other partner are informed WITHOUT searching for days. Also in such a matter that your first Level is informed and Partners don't have to hangle throughs Hours of support calls and prove they have a problem</P>Wed, 02 Oct 2019 09:16:17 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636682#M5486SWISS2019-10-02T09:16:17ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636715#M5489
<P>From what I understand a proof of concept package is being distributed and tested and appears to resolve the issue.&nbsp;</P>Wed, 02 Oct 2019 14:06:40 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636715#M5489meanoldmanning2019-10-02T14:06:40ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636717#M5490
<P>Source?</P>Wed, 02 Oct 2019 14:17:52 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636717#M5490LBX2019-10-02T14:17:52ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636724#M5491
<P>The fellow assigned to my case</P>Wed, 02 Oct 2019 14:47:26 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636724#M5491meanoldmanning2019-10-02T14:47:26ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636727#M5492
<P>Ah right, my support agent has gone quiet.</P>Wed, 02 Oct 2019 14:48:37 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636727#M5492LBX2019-10-02T14:48:37ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636729#M5493
<P>&nbsp;</P><P>Thank you for contacting McAfee Technical Support.</P><P>&nbsp;</P><P>Please note:</P><P>* This tool is a proof of concept only to resolve the reported bug and is not intended for production use.</P><P>* Remove this tool after verifying the issue.</P><P>* Do not redistribute this tool.</P><P>If the PoC testing is successful, please let me know, so I can work with the development team and confirm when the actual product can be delivered.</P><P>&nbsp;</P><P>Please follow the same instruction as before.</P><P>&nbsp;</P><P>PoC Installation.</P><P>&nbsp;</P><P>1) Select a test machine where the issue reproduces</P><P>2) Remove old Point Products</P><P>3) Reboot the machine</P><P>4) Install PoC ( ENS Full package )</P><P>5) Reboot the machine</P><P>6) Test against the reported issue</P>Wed, 02 Oct 2019 15:29:49 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636729#M5493SWISS2019-10-02T15:29:49ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636731#M5494
<LI-SPOILER>&nbsp;</LI-SPOILER><P>You have THIS under Development AND also KNOW it's a BUG between MS and MCAFEE since 10.09.2019 that date and keep us in the dark? Still some GUY pretends HERE that this only some bug which happens to SOME very very little customer base?</P><P>Tell me i am wrong with the dates?</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2019-10-02 17_31_51-Window.png" style="width: 798px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4817i0846ED12BB6BA341/image-size/large?v=1.0&amp;px=999" title="2019-10-02 17_31_51-Window.png" alt="2019-10-02 17_31_51-Window.png" /></span></P><P>&nbsp;</P><DIV class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV>Wed, 02 Oct 2019 15:35:35 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636731#M5494SWISS2019-10-02T15:35:35ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636733#M5495
<P>The KB article acknowledging the bug was published on 28 August 2019.</P><P>&nbsp;</P><P>Those build numbers are newer that what is published live - where is that build from?</P>Wed, 02 Oct 2019 15:38:17 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636733#M5495LBX2019-10-02T15:38:17ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636734#M5496
<P>One MSG in FORUM above from me i mentioned the CASE communucation. This is from development as we understand and they test it now on single machines with customers.&nbsp;</P>Wed, 02 Oct 2019 15:40:41 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636734#M5496SWISS2019-10-02T15:40:41ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636735#M5497
<P>Ah right, I posted my case id too and also asked for access to a preview version and the support agent has blanked me.</P>Wed, 02 Oct 2019 15:43:48 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636735#M5497LBX2019-10-02T15:43:48ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636736#M5498
<P><LI-USER uid="217911"></LI-USER>&nbsp;I'm following up with the owner of your case to get you the test build. We would need feedback by the end of the week though.&nbsp;</P>Wed, 02 Oct 2019 15:47:03 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636736#M5498chealey2019-10-02T15:47:03ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636738#M5499
<P>If you get me the bits today/tomorrow, I'll get some machines testing it and feedback before close of play Friday 4th October (GMT)</P>Wed, 02 Oct 2019 15:51:20 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636738#M5499LBX2019-10-02T15:51:20ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636755#M5500
<P>OK, so I've tested the PoC. It appears to work to correct the reporting issue. I've tried installing as an update and as a clean install as instructed and it definitely requires a clean install. Hopefully the final release will allow for an update to be run since running the removal tool to facilitate a clean install, even across my small organization will be a bit of an issue.</P>Wed, 02 Oct 2019 18:27:58 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636755#M5500meanoldmanning2019-10-02T18:27:58ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636757#M5501
<P>Thank you&nbsp;<LI-USER uid="217692"></LI-USER>&nbsp;, a clean install would definitely be a nightmare...</P>Wed, 02 Oct 2019 18:49:38 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636757#M5501billmoller2019-10-02T18:49:38ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636786#M5502
<P>I'll just wait for final release.. hopefully no clean install, just an upgrade.</P>Thu, 03 Oct 2019 05:56:02 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636786#M5502ilukeberry2019-10-03T05:56:02ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636809#M5504
<P>Clean install wouldn't even be an option for me, my affected users are mostly roaming workstations.</P>Thu, 03 Oct 2019 09:32:15 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636809#M5504kylekat2019-10-03T09:32:15ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636811#M5505
<P>In ePO, I checked in the updated ENS components in to the Master Repository to the Preview branch. I installed the updated extensions first however (which you need to do to be able to check in the ENS components it seems)</P><P>I pushed a task to two machines which executes the latest Endpoint Product Removal tool with the --ENS switch to remove only ENS (leaving the Agent behind) and once rebooted, ran another custom task to push Platform, TP and Web components from the preview branch.</P><P>As the issue mainly presents itself after doing AMCORE updates, it'll really be tomorrow before I can tell if it has fixed it or not.</P><P>&nbsp;</P><P>I'll revert with any findings.</P><P>&nbsp;</P>Thu, 03 Oct 2019 09:43:03 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636811#M5505LBX2019-10-03T09:43:03ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636812#M5506
<P>The fix will not require a clean install <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span>&nbsp; A POC (Proof of concept) build on the other hand needs to be installed in a specific way hence the instructions provided by support when you are given the POC.</P>
<P>&nbsp;</P>Thu, 03 Oct 2019 09:44:23 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/636812#M5506chealey2019-10-03T09:44:23ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637328#M5550
<P>A bunch of updates just showed up as available in Software Manager on ePO. I'm going to clean install on one laptop and update on another and see how it goes</P>Tue, 08 Oct 2019 14:42:44 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637328#M5550meanoldmanning2019-10-08T14:42:44ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637330#M5551
<P><LI-USER uid="206182"></LI-USER>can we confirm if the new releases address the issue discussed on this topic?</P><P>Endpoint Security Platform10.6.1.1724.1</P><P>Endpoint Security Threat Prevention10.6.1.1777.1</P><P><SPAN>Went through the release notes and I don't think there is a mention on it.</SPAN></P><P>&nbsp;</P><P>&nbsp;</P>Tue, 08 Oct 2019 14:57:42 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637330#M5551kylekat2019-10-08T14:57:42ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637337#M5552
<P><LI-USER uid="206182"></LI-USER>, please advise... "if the new releases address the issue discussed on this topic?"</P><P>I/we can't wait another release cycle during which our users are confusingly notified that anti-virus isn't working or is turned off...</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-10-08 111854.png" style="width: 248px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4867i9743D10CCEF63F00/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-10-08 111854.png" alt="Annotation 2019-10-08 111854.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2019-10-08 114000.png" style="width: 384px;"><img src="https://community.mcafee.com/t5/image/serverpage/image-id/4869iDE660E122D50C774/image-size/large?v=1.0&amp;px=999" title="Annotation 2019-10-08 114000.png" alt="Annotation 2019-10-08 114000.png" /></span></P>Tue, 08 Oct 2019 15:41:16 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637337#M5552billmoller2019-10-08T15:41:16ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637338#M5553
<P>Neither install scenario (clean or update) resolves the issue with the new versions pushed to the software manager. The reporting error remains. I kind of assumed this would be the case since I wasn't advised to run these updates by the fellow assigned to my ticket.</P>Tue, 08 Oct 2019 15:40:34 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637338#M5553meanoldmanning2019-10-08T15:40:34ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637341#M5554
<P><LI-USER uid="206182"></LI-USER>, <LI-USER uid="217692"></LI-USER> has indicted the issue still isn't fixed.&nbsp; I believe you told us it would be fixed in the next release, "This issue will be addressed in the next release of the product which is targeted for October."&nbsp; Also, my support case indicates,</P><BLOCKQUOTE><HR /><P>Resolution: The issue is fixed now and will be targeted in the next release of ENS version</P><HR /></BLOCKQUOTE><P>And that was prior to THIS release............... So................. umm.................... ::biting tongue trying to stay civil::</P>Tue, 08 Oct 2019 15:47:15 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637341#M5554billmoller2019-10-08T15:47:15ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637347#M5558
<P>OK, after sitting for a couple hours now the laptop that had a clean install is still reporting that McAfee is OFF and Windows Defender is ON. However, the laptop that had McAfee 'updated' to the new versions now has switched to McAfee reporting it is ON and Windows Defender is OFF. Weird.</P><P><STRONG>EDIT</STRONG> - and now 40 minutes or so later the laptop on which I did a clean install suddenly is reporting properly. Both the laptops had run an update around the same time so I'm not sure there was a content update that triggered either one to turn on.</P><P><STRONG>EDIT 2</STRONG> - Rebooting causing the reporting issue to return, at least short term. I'm not sure how quickly is clears up, but maybe 10 minutes after rebooting it still reports McAfee is OFF</P>Tue, 08 Oct 2019 18:20:35 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637347#M5558meanoldmanning2019-10-08T18:20:35ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637356#M5563
<P><LI-USER uid="217692"></LI-USER>&nbsp; Thanks for the investigative work.&nbsp; Just curious, did you implement the "debug logging" <EM>workaround?</EM>&nbsp; I did, and it seems to work most of the time, but when ENS updates (a daily task), I think AMCore, it returns to McAfee is off...</P>Tue, 08 Oct 2019 18:52:14 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637356#M5563billmoller2019-10-08T18:52:14ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637358#M5564
<P>No, not on the test machines, I wanted to see if the updates corrected the issue on their own. However, I did implement it on the computer I use daily. It was weird in that after implementing it WSC would report correctly until I restarted windows, which I think you experienced too? But if I waited for several minutes (hour?) it would switch back to reporting correctly.&nbsp;</P><P>By the way, after sitting for more than an hour now after being rebooted the two test machines have NOT switched back to reporting correctly</P>Tue, 08 Oct 2019 20:03:32 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637358#M5564meanoldmanning2019-10-08T20:03:32ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637360#M5565
<P><LI-USER uid="217692"></LI-USER>, what does the output of</P><BLOCKQUOTE><HR />get-wmiobject -namespace "root\securitycenter2" -class "antivirusproduct"<BR /><HR /></BLOCKQUOTE><P>show?&nbsp; I guess, more specifically, the "productState"</P><P>On mine, it's currently:</P><BLOCKQUOTE><HR /><P>__GENUS : 2<BR />__CLASS : AntiVirusProduct<BR />__SUPERCLASS :<BR />__DYNASTY : AntiVirusProduct<BR />__RELPATH : AntiVirusProduct.instanceGuid="{1006DC03-1FB1-9E52-7C81-F2FAB48962E3}"<BR />__PROPERTY_COUNT : 6<BR />__DERIVATION : {}<BR />__SERVER : DEL7810-0219<BR />__NAMESPACE : ROOT\securitycenter2<BR />__PATH : \\DEL7810-0219\ROOT\securitycenter2:AntiVirusProduct.instanceGuid="{1006DC03-1FB1-9E52-7C81-<BR />F2FAB48962E3}"<BR />displayName : McAfee Endpoint Security<BR />instanceGuid : {1006DC03-1FB1-9E52-7C81-F2FAB48962E3}<BR />pathToSignedProductExe : C:\Program Files (x86)\McAfee\Endpoint Security\Threat Prevention\AMCFG.EXE<BR />pathToSignedReportingExe : C:\Program Files\McAfee\Endpoint Security\Threat Prevention\mfeensppl.exe<BR />productState : 393232<BR />timestamp : Tue, 08 Oct 2019 12:33:32 GMT<BR />PSComputerName : DEL7810-0219</P><P>__GENUS : 2<BR />__CLASS : AntiVirusProduct<BR />__SUPERCLASS :<BR />__DYNASTY : AntiVirusProduct<BR />__RELPATH : AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"<BR />__PROPERTY_COUNT : 6<BR />__DERIVATION : {}<BR />__SERVER : DEL7810-0219<BR />__NAMESPACE : ROOT\securitycenter2<BR />__PATH : \\DEL7810-0219\ROOT\securitycenter2:AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-<BR />DA132C1ACF46}"<BR />displayName : Windows Defender<BR />instanceGuid : {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}<BR />pathToSignedProductExe : windowsdefender://<BR />pathToSignedReportingExe : %ProgramFiles%\Windows Defender\MsMpeng.exe<BR />productState : 393472<BR />timestamp : Tue, 01 Oct 2019 11:56:37 GMT<BR />PSComputerName : DEL7810-0219</P></BLOCKQUOTE><P>And I think we determined previously that the issue was related to how WSC is interpreting the productState.&nbsp; If yours is still showing 393232 (and one assumes Microsoft didn't change how Windows interprets productState [...more...] for this McAfee issue) then it would appear, in addition to everything you mentioned, that the new ENS build does <EM>not</EM> correct the issue...</P><P>When the "debug logging" <EM>workaround</EM> was working, the productState on my machine was (now seemingly randomly) set to 397312, which caused WSC and WDA to behave properly...</P><P><LI-USER uid="206182"></LI-USER>anything?&nbsp; Hello?</P>Tue, 08 Oct 2019 20:18:16 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637360#M5565billmoller2019-10-08T20:18:16ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637365#M5566
<P>So, curiously I have two instances of McAfee Endpoint Security listed when I run that script. In order, I see ENS, Defender and then ENS again. The first ENS instance reports Product State 397312, then Windows Defender reports 397568 and then the second instance of ENS shows 393232. This is on both machines, either updated or clean installed. In talking to the fellow assigned to my ticket the first ENS reference is an artifact left behind in the registry. I'll copy the results in later if you like, I was trying to save space.</P>Tue, 08 Oct 2019 20:46:41 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637365#M5566meanoldmanning2019-10-08T20:46:41ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637366#M5567
<P>I also had multiple ENS providers listed in WMI.&nbsp; At first, I thought that was the issue, or that WSC was reading the productState of the wrong ENS instance.</P><P>Completely at a loss, I used the Endpoint Product Removal tool to uninstall everything McAfee, then happened upon <A title=" Delete AntiVirusProduct WMI - Clear the anti-virus WMI class" href="https://www.lansweeper.com/Forum/yaf_postst9878_Delete-Antivirus-WMI.aspx#post38305" target="_blank" rel="noopener">Delete AntiVirusProduct WMI - Clear the anti-virus WMI class</A> from 2014 which has a VB script to clean up the errant entries in WMI.</P><P>It mentions, "After a reboot of the client machine, WMI will rebuild this class." which it indeed did on my system.&nbsp; Like I mentioned, ENS was not installed at the time, but WSC/WDA DID re-register itself as an AV provider in WMI (one hopes ENS would do the same).</P><P>YMMV, and disclaimer disclaimer disclaimer, this has the potential to completely hose your system, don't use in a production environment, yadda yadda yadda.</P><P>At that point for me however, I was ready to format...</P><P>I then reinstalled ENS.&nbsp; The WSC/WDA conflicts are still occurring, but I have no more errant WMI AV provider entries.</P>Tue, 08 Oct 2019 20:57:53 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637366#M5567billmoller2019-10-08T20:57:53ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637382#M5568
<P>Good morning all.</P>
<P>We tested an Early Access version of 10.6.1 October Update with customers who had their cases escalated to engineering and we received positive feedback from all of those customers. If the issue persists then this is unexpected and we would need to re-visit the issue along with fresh data from the systems.&nbsp;</P>
<P>I would advise to ensure that once installing the October Update a reboot is performed and to ensure that Windows Defender is disabled via GPO to avoid any conflict. Further please do ensure that the AMCORE is also up to date.</P>
<P>Please follow up in your respective SRs if the issue is not fixed.</P>Wed, 09 Oct 2019 07:44:05 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637382#M5568chealey2019-10-09T07:44:05ZRe: Windows Defender problem reported by MICROSOFThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637389#M5569
<P>We purposely don't disable Defender via GPO, so if Mcafee was ever missing from the devices for any reason or genuinely broken we still have defender as a fallback.</P><P>I'll test out the new update and see how it goes for my systems.</P>Wed, 09 Oct 2019 09:03:23 GMThttps://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-running-and-Windows/m-p/637389#M5569JayMan2019-10-09T09:03:23Z